Hackers Exploiting Malware In Google Docs

Uploaded on 2025-03-06 in TECHNOLOGY--Hackers, NEWS-Cybersecurity News, FREE TO VIEW

A particularly insidious form of malware known as Infostealer is a program that is designed to quietly infect a system and run discretely in the background, to secretly steal sensitive data like passwords or chat logs and send them back to hackers. After it infects a system, it gathers sensitive data such as login credentials, credit card details, chat logs, browsing history and more.

Hackers are now using infostealer on traditional platforms like Google Docs to steal sensitive data from users, according to a new report by AhnLab's Security Intelligence Center (ASEC).

It uses a tactic known as “malware-as-a-service,” which is making it more difficult for security systems to detect threats and is increasingly being used to target both individuals and organisations worldwide.These criminal programs are usually delivered through phishing attacks, compromised websites, masquerading as pirated software or malicious attachments.

One of the most well known infostealers is LummaC2, which has been active since 2022. It targets browsers, stealing critical information like passwords, cookies, and autofill data. But, a newer hacker, ACRStealer, has recently been discovered by ASEC.

ASEC monitors the Infostealer malware disguised as illegal programs such as cracks and keygens being distributed, and publishes related trends and changes through the Ahnlab TIP and ASEC Blog posts. While the majority of the malware distributed in this manner has been the LummaC2 Infostealer, the ACRStealer Infostealer has seen an increase in distribution.

Infostealer is being increasingly used by cyber criminals, specialising in stealing system data, credentials, crypto-currency wallet details, and configuration files from across a range of different programs.

What sets ACRStealer apart is its use of trusted platforms to communicate with its command-and-control (C2) servers. Rather than embedding the C2 address directly in the malware, attackers use platforms like Google Docs, Steam, and Telegra.ph as intermediaries.

By encoding the C2 address in Base64 and storing it on these trusted sites, attackers can avoid detection, making the malware harder to track. This method, known as Dead Drop Resolver (DDR), allows the malware to function with minimal risk of being detected by security software. The type of data ACRStealer is capable of stealing is extensive. It includes not only browser data, but also text files, FTP credentials, remote access program details, and VPN information.

The malware even targets password managers and chat logs, making it a potent tool for cyber criminals seeking to gather sensitive information.

The use of trusted platforms as delivery methods for malware only underscores the growing complexity of modern cyber attacks. As cyber criminals continue to evolve their tactics, both individuals and organisations must stay proactive in their cyber security efforts.

Image: Unsplash

You Might Also Read:

The Proliferation Of Open Source Malware:

If you like this website and use the comprehensive 7,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.